Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698942434809.pdf (South Africa)
REPUBLIC OF SOUTH AFRICA CONSTITUTION TWENTIETH AMENDMENT BILL (As introduced in the National Assembly (proposed section 74(3); explanatory summary of Bill and prior notice of its introduction published in Government Gazette No.

47478 of 9 September 2022 and Government Gazette No.

48589 of 12 May 2023)) (The English text is the offıcial text of the Bill) (ADV G BREYTENBACH MP) [B 20—2023] No.
of copies printed .........................................150 ISBN 978-1-4850-0880-4 GENERAL EXPLANATORY NOTE: [ ] Words in bold type in square brackets indicate omissions from existing enactments.

Words underlined with a solid line indicate insertions in existing enactments.

BILL To amend the Constitution of the Republic of South Africa, 1996, so as to require national legislation to establish a Cyber Commissioner in the Republic; and to provide for matters connected therewith.
BE IT ENACTED by the Parliament of the Republic of South Africa, as follows:— Insertion of section 192A in Constitution of the Republic of South Africa, 1996 1.

The following section is hereby inserted into the Constitution of the Republic of South Africa, 1996 (hereinafter referred to as the Constitution), after section 192: 5 ‘‘Commissioner to Regulate Cyber Security Establishment and functions 192A.

(1) National legislation must establish the Cyber Commissioner.
(2) The Cyber Commissioner must— (a) establish and maintain— (i) (ii) (iii) suitable cyber security capabilities for all organs of state and entities dealing with public information; capabilities to assist the police service with the necessary capacity to conduct cyber forensic investigations; and a cyber security hub for the reporting, monitoring and investigation of cyber security incidents and threats in the private and public sectors; (b) advise the defence force in establishing and maintaining cyber defence (c) capabilities; advise all institutions responsible for the critical infrastructure of the Republic with regard to cyber security; (d) promote, monitor and evaluate the compliance of all organs of state and other entities with regard to— 10 15 20 cyber security capabilities and standards; and (i) (ii) national legislation relating to protection of personal or public 25 information and interception of data; and (e) make recommendations to Cabinet and Parliament to amend existing legislation, or develop new legislation, aimed at protecting— (i) (ii) the rights to freedom and security of the person contained in section 12; the privacy rights contained in section 14; 30 3 (iii) (iv) (v) the political rights contained in section 19; the right to access to information contained in section 32; and the right to just administrative action contained in section 33.
(3) The Cyber Commissioner has the power, as regulated by national legislation to— (a) establish structures for the co-operation between the state and the private sector relating to training standards and the development of national cyber resources and capabilities; and issue regulations and directives to safeguard all organs of state and private sector entities against potential cyber-attacks.
(b) 5 10 (4) The Cyber Commissioner has such additional powers and functions as prescribed by national legislation.

(5) All interception of data capabilities will vest with the Cyber Commissioner.

(6) The Cyber Commissioner must be appointed for a ﬁxed eight-year 15 term, renewable for only one more ﬁxed term of eight years.’’.

Amendment of section 193 of Constitution of the Republic of South Africa, 1996 2.
Section 193 of the Constitution is hereby amended— (a) by the insertion after subsection (3) of the following subsection: ‘‘(3A) The Cyber Commissioner must be a woman or man who is a South African citizen, who is a ﬁt and proper person to hold that office, and who has specialised knowledge of, or a suitable qualiﬁcation in, cyber security and cyber forensics.’’; (b) by the substitution in subsection (4) for the words preceding paragraph (a) of the following words: ‘‘The President, on the recommendation of the National Assembly, must appoint the Public Protector, the Auditor General, the Cyber Commis- sioner and the members of—’’; and (c) by the substitution in subsection (5)(b) for subparagraph (i) of the following subparagraph: ‘‘(i) of at if the least 60 percent of the members of the Assembly, recommendation concerns the appointment of the Public Protector [or], the Auditor-General or the Cyber Commissioner; or’’.
Amendment of section 194 of Constitution of the Republic of South Africa, 1996 3.
Section 194 of the Constitution is hereby amended— (a) by the substitution in subsection (1) for the words preceding paragraph (a) of the following words: ‘‘The Public Protector, the Auditor-General, the Cyber Commissioner or a member of a Commission established by this Chapter may be removed from office only on—’’; and (b) by the substitution in subsection (2) for paragraph (a) of the following paragraph: ‘‘(a) the Public Protector [or], the Auditor-General or the Cyber Commissioner must be adopted with a supporting vote of at least two thirds of the members of the Assembly; or’’.
Amendment of section 219 of Constitution of the Republic of South Africa, 1996 4.
Section 219 of the Constitution is hereby amended by the substitution for subsection (5) of the following subsection: ‘‘(5) National legislation must establish frameworks for determining the salaries, allowances and beneﬁts of judges, the Public Protector, the Auditor-General, [and] the Cyber Commissioner, and members of any commission provided for in the Constitution, including the broadcasting authority referred to in section 192.’’.

20 25 30 35 40 45 50 Transitional provisions and savings 4 5.
(1) National legislation envisaged in section 192A of the Constitution, as inserted by section 1 of this Act, must be enacted within 12 months of the date on which the Constitution Twentieth Amendment Act, 2023 takes effect.
(2) Any law relating to the protection of personal or public information, interception of data or cyber security issues that is in force when this amendment takes effect, remains in force until such time that it is amended or repealed by national legislation contemplated in subsection (1).
(3) Any entity, institution or body, that is responsible for— (a) (b) (c) (d) the protection of personal information and public information; the monitoring of cyber security standards; the reporting, monitoring and investigation of cyber security incidents and threats; or the interception of data, will continue to report and function in terms of existing laws, directives and pre- scripts with all powers afforded thereunder, until such time that such reporting duties, accountability, powers and functions are amended by national legislation referred to in subsection (1).
5 10 15 Short title and commencement 6.

This Act is called the Constitution Twentieth Amendment Act, 2023, and comes 20 into operation on a date determined by the President by proclamation in the Gazette.

5 MEMORANDUM ON THE OBJECTS OF THE CONSTITUTION TWENTIETH AMENDMENT BILL, 2023 1.

INTRODUCTION 1.1 Cyber technology is becoming key to the way in which our world operates and is playing a more central role in society.
The changing nature of how government and society interact with technology and the increasing depen- dence on this resource requires that basic human and other rights should be protected in the process.

1.2 At present, South African state departments and critical infrastructure are not sufficiently protected against cyber threats.

They are also not properly equipped with protecting sensitive public information against hacks.

Further- more, state entities annually lose billions of rands to cybercrime.
The entities currently tasked with dealing with these problems are either underfunded or lack the proper cyber expertise.

They are also scattered across a range of government departments.

1.3 Also, current legislation dealing with cyber security is either insufficient or only deals with the consequences.

1.4 There is therefore an increasing need for the rights of South Africans in terms of cyber technology to be protected and for all matters related to cyber security to be addressed.

2.
2.

OBJECTS OF THE BILL The purpose of the Constitution Twentieth Amendment Bill, 2023 (‘‘the Bill’’) is to amend the Constitution of the Republic of South Africa, 1996 (‘‘the Constitution’’) so as to provide for national legislation to establish a Cyber Commissioner as an independent institution, which is directly accountable to Parliament.
The Cyber Commissioner will be key in safeguarding basic human rights as entrenched in the Constitution, and will possibly replace the role of the Information Regulator over time.

3.

CONTENTS OF THE BILL inter alia, 3.1 Clause 1 of the Bill inserts the new section 192A into the Constitution.
Section 192A requires that national legislation establishes a Cyber Commissioner and provides for the various powers and functions of the Cyber Commissioner, include establishing and maintaining cyber security which, capabilities for all organs of state and entities dealing with public information; establishing and maintaining a cyber security hub for the reporting, monitoring and investigation of cyber security incidents and threats; and advising the defence force in establishing and maintaining cyber defence capabilities.
It further provides that the Cyber Commissioner must be appointed for a ﬁxed eight-year term, renewable for only one more ﬁxed term of eight years.

3.2 Clause 2 of the Bill amends section 193 of the Constitution by inserting a new subsection (3A) to provide that the Cyber Commissioner must be a South African woman or man who is ﬁt and proper to hold that office and has specialised knowledge of, or a suitable qualiﬁcation in cyber security and cyber forensics.
This clause also amends section 193 of the Constitution to provide that the President, on the recommendation of the National Assembly, must appoint the Cyber Commissioner and that the recommendation of the Assembly must be approved by a resolution adopted with a supporting vote of at least 60 percent of the members of the Assembly.
3.3 Clause 3 of the Bill amends section 194 of the Constitution to provide for the removal of the Cyber Commissioner on the listed grounds contained in section 194(1) of the Constitution, and to provide that any resolution of the National 6 Assembly concerning the removal of the Cyber Commissioner must be adopted with a supporting vote of at least two-thirds of the members of the Assembly.
3.4 Clause 4 of the Bill amends section 219(5) of the Constitution so that the salary, allowances and beneﬁts of the Cyber Commissioner are also included in the national legislation envisaged in section 219.

3.5 Clause 5 of the Bill provides for transitional arrangements and savings until such time that the national legislation envisaged in the Bill comes into operation.
It is envisaged that national legislation, enacted within 12 months of this amendment coming into effect, will bring all entities and institutions dealing with, and related to, cyber security, cyber technology, protection of personal and public information and interception of data, together under the Cyber Commissioner’s office.

3.6 Clause 6 of the Bill provides for the short title of the Bill and the commencement date.

4.
4.

FINANCIAL IMPLICATIONS FOR THE STATE Funds will be required to establish the Cyber Commissioner, provide for an office that can execute the envisaged functions, as well as to fund some of its functions.

Already established entities or capabilities that will be incorporated within the office of the Cyber Commissioner are already funded.

5.

ORGANISATIONAL AND PERSONNEL IMPLICATIONS A Cyber Commissioner will need to be recruited and appointed.
An office supporting a Cyber Commissioner will also require cyber and cyber forensic specialists and administrative support.

6.

DEPARTMENTS, BODIES OR PERSONS CONSULTED The following stakeholders were consulted: 6.1 Experts in the ﬁeld of cyber security including a cyber forensic specialist; 6.2 Cyber criminal law practitioners; and 6.3 A senior lecturer in cyber security.

7.
7.

PARLIAMENTARY PROCEDURE 7.1 The Member proposes that the Bill must be dealt with in accordance with the procedure established by section 74(3) of the Constitution since its object is to amend Chapter 9 of the Constitution of the Republic of South Africa, 1996.

7.2 The Member is of the opinion that it is not necessary to refer this Bill to the National House of Traditional and Khoi-San Leaders in terms of section 39(1)(a) of the Traditional and Khoi-San Leadership Act, 2019 (Act No.
3 of 2019), since it does not directly affect traditional or Khoi-San communities or contain any provisions pertaining to customary law or customs of traditional or Khoi-San communities.

Furthermore, the Bill does not contain any provisions pertaining to any matter referred to in section 154(2) of the Constitution.

Printed by Creda Communications ISBN 978-1-4850-0880-4